CVE-2026-93803: wifi: libipw: fix key index receive bound checks

CVE-2026-93803: wifi: libipw: fix key index receive bound checks

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: libipw: fix key index receive bound checks

libipw_rx() reads skb->data[hdrlen + 3] to extract the WEP key index in
both the software-decrypt key selection path and the hardware-decrypted
IV/ICV strip path. In both places the existing guard only checks
skb->len >= hdrlen + 3, which proves bytes up to hdrlen + 2 but not the
byte at hdrlen + 3.

Require hdrlen + 4 bytes before reading that item in both paths. This is
a local source-boundary check only; it does not change the key index
semantics.

The Linux kernel CVE team has assigned CVE-2026-93803 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.12.111 with commit 062840bdc9ee06169b3c371bf66711f1d7ec0bf4
	Fixed in 6.18.53 with commit c54b643e9a0936d038921c547736574fd7382cea
	Fixed in 7.2 with commit 74ed3669f26803b1761c1f55403062bea44c3466

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-93803
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/intel/ipw2x00/libipw_rx.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/062840bdc9ee06169b3c371bf66711f1d7ec0bf4
	https://git.kernel.org/stable/c/c54b643e9a0936d038921c547736574fd7382cea
	https://git.kernel.org/stable/c/74ed3669f26803b1761c1f55403062bea44c3466